Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo-s EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video-s epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.
CVSS 5.4EPSS 0.19499999999999998%Risque 0.55
Voir la source- Publication
- 2026-04-07 20:16:30
- Versions concernées
- <=26.0
- Type
- Installed app
- Dernière modification
- 2026-07-24 21:10:00
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N